docs(release): clarify unsigned Windows executables

SECURITY.md

@@ -151,13 +151,7 @@ cover the downloaded inventory asset itself. `NOASSERTION` licenses or unknown
 sources are explicitly annotated for review. The inventory is a traceability report,
 not a license scan or a claim that all components have been legally reviewed.
 
-**Windows:** Windows release binaries are currently unsigned. The repository contains a
-SignPath artifact-configuration example, but no release-workflow signing integration or
-verified SignPath project/certificate provisioning. Signing is not enforced by the release
-workflow; consumers must not assume an Authenticode signature or Smart App Control
-acceptance. Enabling signing remains blocked on external signing-service and certificate
-provisioning, followed by workflow and published-artifact verification. The previously cited
-PR #79 was unrelated and does not provide evidence for a Smart App Control report.
+**Windows:** Release executables are unsigned. Archive checksums and build-provenance attestations do not provide an executable code signature.
 
 ### Required daemon authority; optional service installation
 

docs/USER-GUIDE.md

@@ -61,14 +61,16 @@ gh attestation verify tracedecay-beta-<tag>-<platform>.tar.gz --repo ScriptedAlc
   --signer-workflow ScriptedAlchemy/tracedecay/.github/workflows/release-beta.yml
 ```
 
-Stable archives (`tracedecay-<tag>-<platform>`) are signed by
-`.github/workflows/release.yml`.
+Stable archives (`tracedecay-<tag>-<platform>`) have build-provenance
+attestations from `.github/workflows/release.yml`.
 
 **Windows:**
 
 Download the x86_64 Windows archive from the
 [latest release](https://github.com/ScriptedAlchemy/tracedecay/releases/latest),
 extract `tracedecay.exe`, and place it on `PATH`.
+The Windows executable is unsigned; archive checksums and build-provenance
+attestations do not provide an executable code signature.
 
 **Prebuilt binaries:**